Vulnpedia
← All CVEs

CVE-2026-15961

MEDIUM 5.2

Published 2026-08-19 · Last modified 2026-08-20

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.1%chance of exploitation in 30 days · 1st percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

5.2CVSS 3.1 · MEDIUM

  • ConfidentialityLow
  • IntegrityLow
  • AvailabilityHigh

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires an admin / high-privilege account
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-15961/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-15961/poc.json

Affected

Vendors Ibm

Products Powervm Hypervisor Power System S1122 \(9824 22a\) Firmware Power System S1122 \(9824 22a\) Power System S1124 \(9824 42a\) Firmware Power System S1124 \(9824 42a\) Power System S1122s \(9824 22b\) Firmware Power System S1122s \(9824 22b\) Power System S1114 \(9824 41b\) Firmware Power System S1114 \(9824 41b\) Power System L1122 \(9856 22h\) Firmware Power System L1122 \(9856 22h\) Power System L1124 \(9856 42h\) Firmware

Weakness (CWE)

  • CWE-134: Use of Externally-Controlled Format String

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H

Known Affected Software Configurations

VendorProductVersion range
IbmPower System S1122 \(9824 22a\) Firmware≥ fw1110.00 and < fw1110.31
IbmPower System S1122 \(9824 22a\) Firmwarefw1120.00
IbmPower System S1124 \(9824 42a\) Firmware≥ fw1110.00 and < fw1110.31
IbmPower System S1124 \(9824 42a\) Firmwarefw1120.00
IbmPower System S1122s \(9824 22b\) Firmware≥ fw1110.00 and < fw1110.31
IbmPower System S1122s \(9824 22b\) Firmwarefw1120.00
IbmPower System S1114 \(9824 41b\) Firmware≥ fw1110.00 and < fw1110.31
IbmPower System S1114 \(9824 41b\) Firmwarefw1120.00
IbmPower System L1122 \(9856 22h\) Firmware≥ fw1110.00 and < fw1110.31
IbmPower System L1122 \(9856 22h\) Firmwarefw1120.00
IbmPower System L1124 \(9856 42h\) Firmware≥ fw1110.00 and < fw1110.31
IbmPower System L1124 \(9856 42h\) Firmwarefw1120.00
IbmPower System E1150 \(9043 Mru\) Firmware≥ fw1110.00 and < fw1110.31
IbmPower System E1150 \(9043 Mru\) Firmwarefw1120.00
IbmPower System S1112 \(9242 21b\) Firmwarefw1120.00
IbmPower System S1112 \(9242 21t\) Firmwarefw1120.00
IbmPower System E1080 \(9080 Hex\) Firmware≥ fw1060.00 and < fw1060.81
IbmPower System S1022 \(9105 22a\) Firmware≥ fw1060.00 and < fw1060.81
IbmPower System S1024 \(9105 42a\) Firmware≥ fw1060.00 and < fw1060.81
IbmPower System S1022s \(9105 22b\) Firmware≥ fw1060.00 and < fw1060.81
IbmPower System S1014 \(9105 41b\) Firmware≥ fw1060.00 and < fw1060.81
IbmPower System L1022 \(9786 22h\) Firmware≥ fw1060.00 and < fw1060.81
IbmPower System L1024 \(9786 42h\) Firmware≥ fw1060.00 and < fw1060.81
IbmPower System E1050 \(9043 Mrx\) Firmware≥ fw1060.00 and < fw1060.81
IbmPower System S1012 \(9028 21b\) Firmware≥ fw1060.00 and < fw1060.81
IbmPower System E1180 \(9080 Heu\) Firmware≥ fw1110.00 and < fw1110.31
IbmPower System E1180 \(9080 Heu\) Firmwarefw1120.00

All CVSS metrics

  • MEDIUM 5.2 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H
  • MEDIUM 5.2 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H
  • MEDIUM 6 v3.1 · NVD Primary
    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

References

Patches & mitigations

Sources: NVD · CVE.org · EPSS